Wireless charging is becoming an increasingly popular charging solution in portable electronic products for a more convenient and safer charging experience than conventional wired charging. However, our research identified new vulnerabilities in wireless charging systems, making them susceptible to intentional electromagnetic interference. These vulnerabilities facilitate a set of novel attack vectors, enabling adversaries to manipulate the charger and perform a series of attacks. In this paper, we propose VoltSchemer, a set of innovative attacks that grant attackers control over commercial-off-the-shelf wireless chargers merely by modulating the voltage from the power supply. These attacks represent the first of its kind, exploiting voltage noises from the power supply to manipulate wireless chargers without necessitating any malicious modifications to the chargers themselves. The significant threats imposed by VoltSchemer are substantiated by three practical attacks, where a charger can be manipulated to: control voice assistants via inaudible voice commands, damage devices being charged through overcharging or overheating, and bypass Qi-standard specified foreign-object-detection mechanism to damage valuable items exposed to intense magnetic fields. We demonstrate the effectiveness and practicality of the VoltSchemer attacks with successful attacks on 9 top-selling COTS wireless chargers. Furthermore, we discuss the security implications of our findings and suggest possible countermeasures to mitigate potential threats.

翻译：无线充电正日益成为便携式电子产品中一种流行的充电解决方案，相较于传统有线充电，它提供了更便捷、更安全的充电体验。然而，我们的研究发现了无线充电系统中的新漏洞，使其容易受到有意电磁干扰的影响。这些漏洞催生了一系列新颖的攻击向量，使攻击者能够操控充电器并执行一系列攻击。在本文中，我们提出了VoltSchemer，这是一组创新性的攻击方法，仅通过调制电源的电压，即可让攻击者控制市售的无线充电器。这些攻击是首次出现，利用了来自电源的电压噪声来操控无线充电器，而无需对充电器本身进行任何恶意修改。VoltSchemer造成的重大威胁通过三种实际攻击得到了证实：充电器可以被操控以通过无声语音命令控制语音助手、通过过充或过热损坏正在充电的设备、以及绕过Qi标准规定的异物检测机制，以损坏暴露于强磁场中的贵重物品。我们通过对9款最畅销的商用无线充电器进行成功攻击，展示了VoltSchemer攻击的有效性和实用性。此外，我们讨论了这些发现的安全影响，并提出了可能的对策以减轻潜在威胁。